According to the Llamarisk postmortem, of the 152,577 rsETH extracted from the LayerZero bridge – equivalent to roughly 163,183 ETH at reference rate – Kelp recovered and froze 40,373 rsETH (~43,168 ETH), and the hacker's own positions on Aave (AAVE) and Compound net a further ~14,168 ETH once supplied and borrowed balances are reconciled. The residual shortfall lands at 105,847 ETH.
(Source: DeFiUnited & defiunited.eth wallet)
The industry response has been substantial but structurally uneven. As of 29 Apr, total commitments reach 138,709.6 ETH, covering the shortfall in full on paper. Most pledged capital remains subject to governance votes and technical execution by third parties, making that capital recoverable but potentially weeks away from settlement, if at all. Confirmed liquid contributions currently stand at 46,944.6 ETH, or roughly 44.4% of the rsETH collateral hole. The Aave (AAVE) DAO proposal for 25,000 ETH – the single largest near-term catalyst – closes within two days and is widely expected to pass, which would bring the immediately deployable base to 71,944.6 ETH, covering approximately 68% of the shortfall. What remains is a governance execution problem as much as a capital one.
Beyond plugging the collateral hole, a parallel stream of liquidity support has been directed into the protocol itself. Tron DAO and HTX committed $20mn in USDT (Tether's US dollar-pegged stablecoin), Renzo deployed $10mn from its treasury in stablecoins, and Babylon contributed a further $3mn in USDT. Many others, including the Solana Foundation and Avalanche Foundation, joined without disclosing amounts.
Fresh liquidity flowing into Aave's supply side compressed utilization rates, brought yields off their stress highs, and allowed the protocol to stabilise operationally while the longer-dated capital commitments work through governance.
From liquidity run to floor
Aave V3 on Ethereum entered 18 Apr with $35.3bn in total supplied capital and $21bn in available unborrowed liquidity – near the top of its year-to-date range. Over the six days that followed the exploit, total supplied assets collapsed by $14bn to $21.3bn, drawing down 39.7% from pre-exploit levels by 27 Apr. Available liquidity was hit harder: the unborrowed buffer contracted 44.8% from $21bn to $11.6bn, while borrowed balances declined more gradually from $14.2bn to $9.8bn, dropping 31% and confirming the move was primarily a supply-side flight. Since DeFi United mobilized around 23 Apr, withdrawal pressure has decelerated sharply, with the unborrowed buffer ticking up marginally from its $11.3bn trough as liquidity slowly gets replenished – a first tentative sign the protocol is finding a floor.
(Data provided by Datum Labs)
Nevertheless, the liquidity recovery in core borrowable markets is a debt-repayment story, not an inflow story. Since DeFi United, supply has continued leaving the protocol across every core asset, with USDT shedding $336.4mn, USDe (Ethena's synthetic dollar) $188.3mn, and USDC $75.8mn.
Meanwhile, debt repayments are outpacing supply withdrawals, and the spread between the two is where available liquidity is being rebuilt. Since 22 Apr, $442.3mn in USDT, $184.6mn in USDC and $192.6mn in USDe have been repaid, freeing $105.9mn, $108.8mn, and $4.3mn in net available liquidity respectively.
(Data provided by Datum Labs)
WETH (wrapped Ether) and the eMode collateral assets tell the same story from both sides of the same trade. WEETH and WSTETH supply – pure collateral assets running at 0% and 3.4% utilization pre-exploit – has shed $252mn and $422mn respectively, against relatively negligible borrow-side deltas.
Those are most likely loopers exiting, pulling LST (liquid staking token) collateral and simultaneously closing their WETH borrow leg. The near-perfect symmetry between collateral outflows and WETH repayments is what keeps WETH pinned at 100% utilization since 19 Apr, as any liquidity momentarily freed by a repayment or a supply is immediately consumed by the next looper in the queue, with available liquidity effectively at zero throughout.
The ceiling and the unwind
As the situation moves towards resolution, the repayment dynamic is beginning to pull utilization rates off their stress peaks – slowly, and unevenly across assets.
USDC and USDT were the first to break. Pre-exploit utilization was running at 79.5% and 78.6% on 18 Apr – elevated but functional, with $665.2mn and $942.5mn available respectively. By 19 Apr, USDT had spiked to 96.3% and WETH hit 100% as the bank run began; by 20 Apr both USDC and USDT reached the ceiling, with available liquidity effectively zero, as suppliers rushed for the exit faster than borrowers could repay.
(Data provided by Datum Labs)
USDe followed a candle later – its utilization rate spiked to 100% on 20 Apr, a day after the core stablecoin markets seized, consistent with contagion spreading from the primary liquidity pools outward.
The USDe dynamic has a specific structural explanation. Aave lists USDe and sUSDe as collateral on V3 Core Ethereum, allowing users to borrow USDC and USDT against them. Loopers had built leveraged yield positions on top of this, and when the Kelp incident triggered a confidence shock and USDC/USDT suppliers pulled liquidity, utilization in those markets hit 100%, locking the exit for anyone trying to unwind.
As borrowing costs exceeded the yield on the collateral leg, the carry trade turned deeply negative. Loopers withdrew their USDe and sUSDe collateral from Aave and swapped it into USDC and USDT to repay their debt, erasing roughly $1.66bn in combined supplied balance since 18 Apr, directly contracting USDe circulating supply in the process, down $2.08bn over the same period.
Since DeFi United mobilized around 23 Apr, utilization rates in core stablecoin markets have been grinding lower – USDC from 100% to 94.1%, USDT from 100% to 94.5%, USDe from 100% to 92.7% – directionally correct, but still running well above the range that characterised pre-exploit conditions.
The price of panic
Interest rates are the first-order derivative of utilization, and the hourly sequence makes the transmission mechanism explicit. On 18 Apr at 19:00UTC, WETH borrow spiked from 2.31% to 8.35% in a single candle. The hacker deposited stolen rsETH as collateral and drew down WETH against it, the first demand shock to hit the protocol before any broader market panic had materialized.
(Data provided by Datum Labs)
The contagion sequence then unfolds candle by candle as liquidity dries up. USDT borrow crossed 8.65% by 19 Apr 00:00UTC, hit 13.29% by 01:00UTC, and was pinned at the 14.00% rate ceiling by 04:00UTC. USDC followed four hours behind, reaching 14.00% at 05:00UTC. USDe was last, spiking from 2.93% to 10.79% between 04:00UTC and 06:00UTC as the stablecoin market seizure propagated through to the collateral pool, peaking at 16.00% by 12:00UTC – eight hours after USDT had already maxed out.
At those levels, the carry trade that had supported the looper ecosystem was deeply inverted. A sUSDe position earning roughly 4–5% in native yield was now servicing USDC borrowing costs running at ~14% – a 9.5% carry deficit at the peak on 20 Apr. Same story for WETH and LST loopers, as WEETH and WSTETH positions earning roughly 3.5% in native staking yield were suddenly servicing WETH borrow costs at 8.35%.
The trade that made sense with lower borrowing costs had become structurally loss-making overnight, with no clean path to exit as utilization locked the pools.
Since DeFi United mobilized around 23 Apr, rates have compressed in lockstep with utilization retreating. USDC borrowing has fallen from 14.00% to 4.35%, USDT from 14.00% to 5.37%, and USD from 16.00% to 3.99%. WETH borrow has stabilized around 4.89–5.00% since 21 Apr, anchored by the looper exit queue keeping utilization pinned.
From an interest rate perspective, the situation has largely stabilized. Borrowing costs are back in the range of pre-exploit norms, the carry inversion that forced the mass unwind has closed, and stress pricing has left the market. The pools it reflects are structurally thinner than they were on 17 Apr, but the rate signal is no longer one of crisis.
Liquidation engine that never fired
The rsETH bridge exploit should have produced one of the largest liquidation cascades in DeFi history. A market depeg on an asset with hundreds of millions of dollars in active collateral, deployed across Aave V3 Core, ought to have triggered thousands of liquidations as positions crossed below their solvency thresholds. Instead, across the entire event window of 18 Apr through 25 Apr, the system processed zero.
Datum Labs' indexing of every rsETH-collateral user on Aave V3 across 252 hourly archive snapshots between 15 Apr and 26 Apr returns zero bad debt and zero underwater users at any point in the event window. From the protocol's own perspective, no position on rsETH was ever liquidatable.
This held even as rsETH's market price collapsed. Under normal conditions, rsETH and ETH move in lockstep, but the 18 Apr KelpDAO exploit broke that relationship. Secondary market participants began pricing in the undercollateralized supply and exit flows pushed rsETH off its peg, 3.89% by the first depeg candle, 6.04% by the end of day 19 Apr, and a peak dislocation of 19.21% against ETH by 22 Apr. The full contagion spread, materializing roughly 96 hours post-exploit.
(Source: TradingView)
Aave's rsETH oracle, which references the asset's internal exchange rate rather than market price, was frozen. Health factors in every rsETH-collateralized position, including the heavily leveraged ones that triggered the freeze, stayed marginally above the liquidation threshold throughout the entire window.
The frozen oracle was the proximate cause as it didn’t propagate the depeg, but according to Datum Labs, a secondary structural layer in the liquidator economy would have failed even if the oracle had been updated. The liquidator's profit and loss on any single liquidation reduces to a gross liquidation bonus, minus DEX slippage on selling the seized collateral, minus gas. Across major collateral assets in normal conditions, this expression is comfortably positive.
Once collateral value falls below debt value, no liquidation bonus can be paid out of the seized collateral because there is no longer enough collateral to repay the debt, let alone reward the liquidator. Even before that inversion point, the depeg itself turned the trade unprofitable. DEX liquidity for rsETH was thin and one-sided, meaning any liquidator attempting to sell seized collateral would move the price further against themselves, consuming the bonus before breaking even.
Compounding this, 31% of the most profitable liquidator events use Balancer flash loans for capital, Datum Labs metrics show, which means liquidator infrastructure depends on flash loan availability, DEX liquidity for the swap, and a borrowable repayment asset on the lending protocol.
(Data provided by Datum Labs)
All of these dependencies failed simultaneously: WETH reserves on Ethereum, Arbitrum, Base, Linea, and Mantle hit 100% utilization, and at full utilization, Aave returns aWETH rather than underlying WETH to liquidators, slowing throughput further. Even a willing, well-capitalized liquidator with the correct oracle signal would have struggled to access the WETH needed to repay the debt.
Two views of bad debt now exist in parallel. In the protocol's accounting view, computed against the static oracle, bad debt is $0. In the market's view, the ~15% collateral gap between circulating rsETH and its actual backing represents a pending shortfall of $123.7mn to $230.1mn, according to Aave’s risk manager Llamarisk, depending on the path KelpDAO picks to absorb the debt.
While freezing the oracle contained the immediate contagion and prevented a liquidation cascade, it also crystallized the design gaps the event exposed. Proof-of-reserves exists in concept, but for LSTs and LRTs it remains largely theoretical. Kelp, Renzo, and peers publish exchange rates via unverified contracts whose own backing assumptions can be silently invalidated. Moreover, most lending protocols use static liquidation bonuses set at listing, a fixed incentive calibrated against normal market conditions. When realised slippage on a depegged LST exceeds that bonus, liquidator economics invert. A slippage-scaled bonus that widens automatically as market depth deteriorates would restore liquidator incentives precisely when they are needed most in stress periods.
Capital flight to safety
Amid the turmoil, Sky's Spark, a decentralized lending protocol, was one of the few major venues where contagion stayed contained. For core assets, utilization rates held roughly pinned around the ~90% kink level, avoiding the ceiling breaks and market seizures that cascaded through Aave.
Credit rates stayed correspondingly stable, with two isolated exceptions: WETH at 21:00UTC on 18 Apr, where borrowing rates spiked to 90.6% in the hours immediately following the exploit before normalising back to ~2% over ten hours, and USDT between 10:00–15:00UTC on 20 Apr, where utilization deviated upward and borrow rates briefly peaked at 19.9% before retracing the same afternoon.
(Data provided by Datum Labs)
Outside those two contained episodes, the protocol continued to operate within normal parameters throughout the event window. The structural reason traces back to a governance decision made months earlier. In late January, Spark executed a proposal to remove rsETH from its approved collateral list in the interest of tightening its safety margin. Supplied rsETH on the protocol declined steadily from $25.5mn earlier in the year to near zero by 9 Apr – $9.4mn removed in that final leg – leaving the protocol with effectively marginal exposure on the day of the exploit.
Beyond rsETH, Spark's collateral framework is deliberately narrow: WEETH and WSTETH carry zero borrowing capacity, which structurally prevents the leveraged LST loop dynamic that amplifies contagion across ETH-correlated markets.
(Data provided by Datum Labs)
In the ten days following the exploit, Aave saw $9.63bn in outflows across comparable core market assets while Spark absorbed $1.6bn in inflows – $877.9mn in ETH LSTs, $521.5mn in USDT, $207.4mn in WETH, and $9.9mn in USDC. Beyond ETH-correlated markets and stablecoins, a significant contribution to Spark's $2.1bn TVL increase – a 71.2% rise over ten days – came from Bitcoin wrapped collateral, with $215.1mn flowing in across LBTC and cbBTC, underscoring that the rotation was broad-based rather than confined to a single asset class.
After the stress test
The coordinated response has been swift by any prior standard – pledged capital nominally covers the gap, rates have come off their stress peaks, and the acute phase of the bank run appears to have run its course. But paper commitments and settled liquidity are different things, and the governance machinery that converts one into the other operates on its own timeline. The hard work – resolving bad debt, rebuilding pool depth, restoring depositor confidence – is still ahead.
The broader mark on DeFi liquidity will take longer to fade. A drawdown of this magnitude from the ecosystem's largest lending venue is not unwound by rate normalization alone. The capital that exited under panic conditions returns on its own terms, when the structural questions the event raised have been credibly addressed. For now, the hole is being filled. Whether the lesson sticks is the question that will define the next chapter.
